Description
jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jhy | jsoup | < 1.15.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jsoup | 1.15.3-1 | — |
| Debian 13 | jsoup | 1.15.3-1 | — |
| Debian 12 | jsoup | 1.15.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jsoup | No fix yet | — |
| Ubuntu 26.04 LTS | jsoup | No fix yet | — |
| Ubuntu 25.10 | jsoup | No fix yet | — |
| Ubuntu 24.04 LTS | jsoup | No fix yet | — |
| Ubuntu 22.04 LTS | jsoup | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jsoup | No fix yet | — |
| Ubuntu 18.04 LTS | jsoup | No fix yet | — |
| Ubuntu 16.04 LTS | jsoup | No fix yet | — |
| Ubuntu Pro 14.04 LTS | jsoup | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.24-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-2.SP1_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.18-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-cert-helper +1 | 1.1.3-1.redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.55-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-39.Final_redhat_00039.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.12-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jsoup | 1.15.4-1.redhat_00003.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.19-1.GA_redhat_00002.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.19-1.GA_redhat_00002.1.el8eap | RHSA-2024:8077, RHSA-2024:8076 |
| Red Hat JBoss EAP 7 | eap7-xalan-j2 | 2.7.1-37.redhat_00015.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | jsoup | 1.15.3-150200.3.6.1 | SUSE-SU-2022:4011-1 |
| SLES 15 SP3 | jsoup | 1.15.3-150200.3.6.1 | SUSE-SU-2022:4011-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | jsoup | 1.15.3-150200.3.6.1 | SUSE-SU-2022:4011-1 |
| openSUSE Leap 15.3 | jsoup | 1.15.3-150200.3.6.1 | SUSE-SU-2022:4011-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | jsoup +1 | 1.13.1-9.amzn2023.0.5 | ALAS2023-2023-315 |
| Amazon Linux 2 | jsoup +1 | 1.6.1-10.amzn2.0.1 | ALAS2-2024-2466 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | jsoup | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | jsoup | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jsoup:jsoup | < 1.15.3 | 1.15.3 | GHSA-gp7f-rwcx-9369 |
Advisories 24
- RHSA-2024:8077 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:8075 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:8076 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- SUSE-SU-2022:4011-1 Security update for jsoup SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2025-0129 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2024-1642 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-2131 Red Hat Enterprise Linux (Migration Toolkit): Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Oct 14, 2024
- NCSC-2024-0294 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-0888 Oracle Systems: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- ALAS2-2024-2466 Moderate: jsoup security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 19, 2024
- WID-SEC-2024-0124 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2675 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- ALAS2023-2023-315 Moderate: jsoup security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 23, 2023
- WID-SEC-2023-1808 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1403 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 8, 2023
- WID-SEC-2023-1032 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-1031 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-1020 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-1017 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-0133 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023